Full [un]prompted coverage here:
Bill Brenner
The cybersecurity profession is confronting a fundamental question: What happens when artificial intelligence can perform work that once required years of specialized human expertise?
At [un]prompted II in San Francisco this week, some of the industry's leading researchers, hackers and security practitioners offered answers grounded in experiments, operational experience and a willingness to challenge established practices.
The three-day conference, organized under the leadership of Gadi Evron, CEO and co-founder of Knostic, brought together researchers examining autonomous attacks, AI-powered vulnerability discovery, agent containment, software remediation and the growing gap between enterprise AI governance and actual employee behavior.
In his October 29 presentation, Being AI-Native Relevant: The Hobby Way, Evron argued that security practitioners must move beyond using AI to accelerate existing work and begin imagining entirely different ways of solving problems.
"The attackers' singularity moment already happened. Now it's time for ours," he said.
The presentation provided a fitting conclusion to a conference that repeatedly demonstrated both the dangers of increasingly capable AI systems and the opportunities they create for defenders.
Staying relevant means experimenting
Evron's presentation was less a prediction about the future than an account of what he has been doing to prepare for it.
He described experimenting with hundreds of Claude Code and Codex projects, deliberately working at what he called the jagged edge of capabilities that do not yet work reliably.
His approach is to explore, fail, revise and try again.
"I stay relevant by failing forward," one slide declared.
He also described himself as a maker, approaching AI through the same curiosity that has historically driven hacker culture.
That experimentation led him into vulnerability research, where he began questioning whether conventional approaches to finding and fixing software flaws would remain sufficient.
Rather than simply asking AI to discover familiar vulnerability classes, Evron explored ways to identify inconsistencies in software behavior, missing security checks and differences between what code promises to do and what it actually does.
One experiment involved identifying asymmetries among related functions. If three functions enforce a particular security check and a fourth does not, could an AI-assisted system identify that difference as a potential vulnerability?
Other experiments examined discrepancies between code and its documentation, relationships among trust boundaries and patterns in application behavior.
The work eventually led to an approach he called Code Surf, which maps relationships among values, call sites, routes, trust zones and conditions.
The underlying objective was to look beyond known vulnerability signatures and identify suspicious patterns in how software operates.
Evron's presentation also acknowledged the difficulties involved.
In one experiment, he reported generating 2,500 findings against a codebase, with only one categorized as a defense-in-depth issue. That result prompted further collaboration with John Cartwright, whose AI-assisted analysis suggested examining the defensive guards already protecting the affected code.
The resulting change in perspective became one of the presentation's central lessons.
Instead of endlessly accumulating vulnerability findings, defenders could focus more heavily on understanding, maintaining and monitoring the security controls that prevent those findings from becoming exploitable.
Evron described the concept as guard coverage regression: identifying which protections matter, where they operate and whether changes to software weaken them.
"AppSec is Now Ops," one slide declared.
His argument was not that organizations should stop fixing vulnerabilities. He explicitly said they should continue doing so.
But he questioned whether traditional vulnerability remediation can remain the primary organizing principle of application security as AI makes finding potential flaws increasingly inexpensive.
AI vulnerability discovery is advancing. Remediation must catch up.
That challenge was also central to Taesoo Kim's presentation. Kim, vice president of security research at Microsoft, discussed the evolution of autonomous vulnerability research from Team Atlanta's victory in DARPA's AI Cyber Challenge to ongoing work involving MDASH and Microsoft's FORGE Lab.
The important distinction was between discovering vulnerabilities in a competition and building systems capable of finding and repairing real weaknesses across production-scale codebases.
Kim described how large language model reasoning can be combined with traditional program analysis to improve vulnerability discovery. But the broader lesson was that finding bugs is only one part of the problem.
Organizations also need to establish whether reported vulnerabilities are real, determine their significance, develop appropriate fixes and validate that those fixes do not introduce new problems.
Evron's experiments suggested that the volume of potential findings could become less useful than understanding which defenses actually prevent exploitation.
Kim's work addressed the challenge of operationalizing autonomous discovery and repair.
Together, they pointed toward a future in which software security is judged less by how many vulnerabilities tools identify and more by whether organizations can reliably reduce exposure.
What happens when software starts repairing itself?
Evron and CTO Imri Goldberg pushed that question further in another presentation exploring AI-driven software modification.
Their talk, From Speculative Engineering Fiction (eng-fi) to… Now, examined the possibility of applications that detect problems, generate fixes and modify themselves while running.
Demonstrations involving the video game Doom and a SQL injection scenario illustrated how AI-assisted systems could alter software behavior and move from detection toward live patching.
The larger concept was what the speakers called live mutable software.
In such an environment, software would no longer change exclusively through conventional development and release cycles.
Instead, AI agents could potentially become continuous participants in monitoring, modifying and maintaining applications.
The speakers were also clear about the unresolved engineering problem: How can organizations verify that automatically generated changes are safe?
They explored behavioral guarantees, formal verification, monitoring and recovery mechanisms as potential safeguards.
The presentation did not establish that autonomous live patching is ready for widespread production use. It demonstrated a direction for research and the controls that would be necessary to make it dependable.
That emphasis on both experimentation and verification reflected the broader character of [un]prompted II.
AI agents are powerful. Containing them is another matter.
Elie Bursztein, distinguished research scientist at Google DeepMind, approached the problem from a different direction.
His presentation, Taming AI Agents with Capsem: Hardware Sandboxing That Doesn't Kill Productivity, addressed the risks created when autonomous agents receive access to networks, files, sensitive information and code execution.
As organizations grant agents more authority, prompt injection and other failures can become pathways to consequences beyond an incorrect chatbot response.
Bursztein presented Capsem, an open-source sandboxing system built around hardened virtual machines and a Rust co-designed hypervisor.
Its design emphasizes isolation while preserving usability, including agent-ready virtual machines that boot in under two seconds.
The system also incorporates observability and enforcement capabilities, including network-level reconstruction with model and Model Context Protocol semantics.
The practical lesson was that securing AI agents cannot depend entirely on convincing them to follow instructions. Organizations also need enforceable boundaries around what agents can access and execute.
Where Kim and Evron explored how AI might transform vulnerability research, Bursztein addressed the infrastructure needed to keep increasingly autonomous systems under control.
The attackers are already experimenting
Several presentations made clear why that work matters.
Gabi Nakibly and Zvika Babo of Radware described a large-scale investigation of indirect prompt injection across 86 million GitHub items, including issues, pull requests, comments and README files.
Their research identified prompt injections in approximately 2.5 out of every 100,000 items examined.
The injections served multiple purposes, ranging from attempts to influence automated project workflows and constrain bots to growth hacking and malicious data exfiltration.
The research showed that prompt injection is not limited to laboratory demonstrations. Attempts to influence AI-driven workflows are appearing in real development environments, even if the identified prevalence in the scanned material was relatively low.
Caleb Sima and Alec Eckmann examined another dimension of the problem in “WTF Was That?” Dispatches From the Wrong End of an Agent Swarm.
Their presentation described the pressure created when an AI adversary pursues several intrusion paths simultaneously.
Traditional incident response procedures often assume analysts can investigate and contain one attack path before moving to the next.
That assumption becomes increasingly difficult to maintain when multiple paths are progressing at machine speed.
An incident response team may have the expertise to investigate every individual intrusion path but still fall behind when several require attention at the same time.
The implication is that defenders must reconsider not only their detection technologies but also how response work is organized.
AI governance fails when employees avoid it
Not every consequential lesson involved advanced vulnerability research or autonomous attacks.
Olivia Rose and Kayla Williams, former CISOs and co-founders of Williams Rose AI Cyber Advisory, presented one of the conference's clearest examples of how conventional security practices can fail when they collide with real-world AI adoption.
A pharmaceutical company had implemented a formal AI intake and risk-classification process, complete with review requirements and governance controls. Yet employees were barely using it.
A review of 24 hours of logs uncovered 35 unauthorized AI uses, while the formal intake process had captured only a small number of requests.
The problem was not a complete absence of governance. It was a process that imposed lengthy reviews on employees who could begin using AI tools almost immediately.
Rose and Williams redesigned the program around the risk of specific use cases rather than applying the same approval burden to every tool.
Low-risk applications received faster, sometimes immediate approval. More consequential uses continued to require human oversight.
The revised process also introduced amnesty for employees who disclosed AI tools they were already using.
The results presented at the conference showed intake submissions rising from 20 to 96 over comparable three-month periods, a 380% increase.
Low-risk approval times fell from four weeks to immediate approval or one day, while high-risk decisions dropped from six to eight weeks to approximately one week.
The case study demonstrated an important principle: Security controls provide limited protection when the people expected to follow them avoid the process altogether.
It was also a reminder that the AI security problem extends beyond technical defenses.
Organizations must design governance systems that work at the speed and scale of actual AI adoption.
Why [un]prompted II matters
Taken together, the presentations illustrated why [un]prompted is establishing a distinctive place in the AI cybersecurity conversation.
The event brought together researchers working on the underlying technologies, practitioners confronting operational consequences and security leaders trying to translate emerging capabilities into workable controls.
The program included Bruce Schneier on integrity in AI systems, Chenxi Wang and Jasmine Jaksic on the realities of enterprise agent deployments, and Rich Mogull on reducing unnecessary complexity in security architectures.
It also featured direct debates over competing assumptions about AI security, including whether traditional defensive approaches can withstand agent swarms.
The conference's value was not that every speaker agreed on the future or that every demonstration represented a production-ready solution.
The value was the opportunity to examine the evidence, challenge the assumptions and learn from experiments that exposed both possibilities and limitations.
That is particularly important in an industry where AI announcements frequently move faster than operational proof.
The strongest presentations did not simply promise that AI would transform cybersecurity.
They examined how that transformation might work, what could go wrong and what security practitioners would have to change to make it useful.
The future of hacking is still being invented
Evron's closing message returned to an argument he made in his foreword to the 40th anniversary edition of Phrack, released during [un]prompted II.
In that essay, he acknowledged the sense of loss experienced by hackers watching AI automate skills they spent years developing.
Reverse engineering, code auditing and vulnerability discovery have long been central to the profession's identity.
As those capabilities become increasingly accessible through AI, the question of what makes a hacker valuable becomes more urgent.
Evron's answer focused on the curiosity, experimentation and willingness to challenge assumptions that produced those skills in the first place.
He returned to that theme in his final presentation, quoting his earlier argument:
"We've always automated ourselves out of the work we were doing, inventing what came next."
The statement connects the week's technical presentations to a larger professional challenge.
AI is changing vulnerability research, software engineering, incident response, threat intelligence and enterprise governance.
Some established practices will become less useful. Others will require substantial redesign. Entirely new approaches are emerging, though many remain experimental.
The researchers at [un]prompted II offered no single formula for navigating that transition.
What they demonstrated was the importance of continuing to build, test, question and share what they learn.
Evron closed with a call for the hacker community to reclaim its role in shaping AI's future rather than leaving that future to technology marketing.
"Join us for The Hackening. Take AI back from the marketers."
For a conference built around the people actually working with these technologies, it was an appropriate conclusion.
And perhaps the clearest explanation of what [un]prompted II set out to accomplish.
